HypothesisVery high confidenceCurrent
Supporting both Microsoft-native and self-hosted/open deployments requires customer-owned policy semantics and evidence formats, not merely component substitution.
Dataheart needs a portable core plus explicit deployment-profile extensions.
Valid from2026-08-23
Last reviewed2026-08-23
Review again2026-11-21
Dataheart stanceexploring
Evidence for
AuthZEN separates the decision API from PDP implementation.
OpenID AuthZEN Authorization API 1.0 Final · openid.net ↗SPIFFE Standard, version 1.15.2 · spiffe.io ↗Microsoft Entra — Workload Identity Federation · learn.microsoft.com ↗Microsoft, SPIFFE, OPA and database systems expose different native identity and policy representations.
OpenID AuthZEN Authorization API 1.0 Final · openid.net ↗SPIFFE Standard, version 1.15.2 · spiffe.io ↗Microsoft Entra — Workload Identity Federation · learn.microsoft.com ↗Evidence against
Perfect semantic portability is not achievable for vendor-specific capabilities such as particular Conditional Access or BI behaviors.
OpenID AuthZEN Authorization API 1.0 Final · openid.net ↗SPIFFE Standard, version 1.15.2 · spiffe.io ↗Microsoft Entra — Workload Identity Federation · learn.microsoft.com ↗How this claim can fall
Replace this placeholder during human review with an observable result that would materially weaken or falsify the claim.
A published claim remains useful only while it remains possible to prove it wrong.